REMARKS 

Claims 1-45 were pending in the application prior to this amendment. Claims 1-45 
stand rejected. Claims 1-10, 13-25, 33-38 and 43-45 have been amended. Claims 41 and 42 
have been cancelled. Applicant requests allowance of all pending claims. 

Claim Rejections - 35 U.S.C. §101 

Claims 13-24 are rejected under 35 U.S. C. § 101 because the claimed invention is 
directed to non-statutory subject matter. "Computer readable medium" is directed to non- 
statutory subject matter and fails to meet a statutory category of invention. 

Claims 13-24 have been amended. 

Claim Rejections - 35 US.C §102 

Claims 1-5, 10-18, 22-27, 31-39 and 41-44 are rejected under 35 U.S.C. § 102(b) as 
being anticipated by Babu et aL, U.S. Patent No. 6,122,639 (hereinafter Babu). 

Claim 1 has been amended. Applicant claims a method of determining whether to 
issue an alarm indicating a network intrusion responsive to receiving the node information by 
comparing a unique identifier included in said node infomiation to a database. When the 
node information corresponds to an existing database entry, the alami is not issued and at 
least a portion of the node information is automatically linked to the existing database entry. 
This feature avoids disrupting a technical support agent with an alarm falsely indicating a 
network intrusion, particularly when the node is subject to dynamic IP address assignment. 
See page 3, lines 1 -3. None of the references teach at least the feature of "detemiining 
whether to issue an alarni responsive to receiving the node information by comparing a 
unique identifier included in said node infomiation to a database." 

Babu discloses a change detection mechanism 30 capable of detecting changes in a 
network. See FIG. 2. The change detection mechanism 30 may generate a report 22 in log 
file format that conveys the meaning of the change information. See FIG. 2. The change 
detection mechanism does not determine whether to issue an alarm indicating a network 
intrusion responsive to receiving the node information by comparing a unique identifier 
included in said node information to a database. 

In contrast, claim 1 includes the feature of determining whether to issue an alaiTn 
indicating a network intrusion responsive to receiving the node infomiation by comparing a 
unique identifier included in said node infomiation to a database. Thus, claim 1 should be 
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allowed. Claims 2-5 and 10-12 are dependent and should be allowed for at least the same 
reason as claun 1 . 

Claims 2 and 3 have been amended. For example, claim 2 includes the feature of 
analyzing the node information to select the unique identifier, wherein the selected unique 
identifier is not a network address such that a false alarm is not sent even when the node is 
subject to dynamic address assigrmient. Some of the advantages of this feature are described 
on page 2. lines 5-25 of the present specification. None of the references disclose this 
feature, and thus claim 2 should be allowed for this additional reason. Claim 3 should be 
allowed for at least similar reasons as claim 2. 

Claim 4 has been amended. See FIG. 4 of the present specification. Advantages of 
using these different values for the unique identifier are described in the present specification 
pages 13-16. None of the references disclose the hierarchy of prefeiTed unique identifiers 
described in claim 4, and thus claim 4 should be allowed for this additional reason. 

Claim 5 has been amended and should be allowed for at least similar additional 
reasons as described with respect to claim 2. See the present specification page 2, lines 5-25. 
As stated previously, claims 10-12 are dependent and should be allowed for at least the same 
reason as claim 1 . 

Claims 13, 25 and 36 have been amended and should be allowed for at least similar 
reasons as claim 1. Claims 14-18, 22-24, 26-27, 31-35 and 37-39 are dependent and should 
be allowed for at least similar reasons as their respective base claims. 

Claim 43 has been put into independent form. No amendments have been made to 
claim 43. None of the references disclose the feature of ''wherein said engine is further 
operable to determine if a media access control (MAC) address from said node information 
matches a MAC address in said database, // there is not a unique identifier in said node 
information,^' (emphasis added). An example of this feature is disclosed in the present 
specification (FIG. 4) where it shows a process for tracking entities such that when an SID or 
S/N are not available, the processes uses a MAC address for the determination. None of the 
references disclose this hierarchical process of initially attempting to rely on a unique 
identifier, and then using a MAC address when the unique identifier is not found. Some of 
the advantages of this feature are described on page 2, lines 5-25 of the present specification. 
Thus, claim 43 should be allowed. Claim 44 is dependent and should be allowed. Claims 41- 
42 have been cancelled. 
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Claim Rejections - 35 US.C. §103 

Claims 6-7, 9, 19, 21, 28, 40 and 45 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Babu in view of Bahl, U.S. Patent No. 7.146,718 (hereinafter Bahl). 

Claims 6-7, 9, 19, 21, 28, 40 and 45 are dependent and should be allowed for at least 
the same reasons as discussed previously. 

Claims 8, 20 and 29-30 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Babu and Bahl and further in view of Romohr, U.S. Patent No. 5,596,723 (hereinafter 
Romohr). 

Claims 8, 20 and 29-30 are dependent and should be allowed for at least the same 
reasons as discussed previously. 



For the foregoing reasons, reconsideration and allowance of all pending claims is 
requested. The Examiner is encouraged to telephone the undersigned at (503) 222-3613 if it 
appears that an interview would be helpful in advancing the case. 



CONCLUSION 



Respectfully submitted. 
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